Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 03 Aug 2001 05:34:29 -0400
From:      Ted Sikora <tsikora@home.com>
To:        "freebsd-stable@FreeBSD.ORG" <freebsd-stable@FreeBSD.ORG>
Subject:   Re: Bridge?
Message-ID:  <3B6A7025.A5F8643F@home.com>
References:  <03f501c11bc9$fec84a00$0300a8c0@laptop>

next in thread | previous in thread | raw e-mail | index | archive | help
Mike Porter wrote:
> 
> -----Original Message-----
> From: Ted Sikora <tsikora@home.com>
> To: freebsd-stable@FreeBSD.ORG <freebsd-stable@FreeBSD.ORG>
> Date: Thursday, August 02, 2001 10:35 AM
> Subject: Re: Bridge?
> 
> >Ted Sikora wrote:
> >>
> >> I have stable on both cable and dsl. The following message (rpc.statd:
> >> invalid hostname to sm_stat: ^X÷ÿ¿^X÷ÿ¿^)
> >> has been a mainstay in stable for some time. I have 2 nic cards in the
> >> machines. Do I need the 'options BRIDGE' in the kernel? I just set up a
> >> firewall and that did not eliminate the messages.
> >>
> >
> >That was it. I guess the Bridge option is needed with cable and dsl
> >modems.
> >
> 
> Well geezs if that's all I have to do....
> 
> I have been getting those, but I thought it was related to, being on cable,
> someone trying a windoze exploit. (smb_stat==something related to
> samba/windows networkng (SMB), at least in my mind...)
> 

Ha! an old one is back:

Aug  2 20:07:36 dhcp-209-54-72-117 /kernel: arp: 192.168.1.1 is on ed0
but got reply from 00:20:78:d4:a5:87 on dc0
*********************************** WHO IS THIS??
***********************************
Aug  2 20:08:02 dhcp-209-54-72-117 last message repeated 2 times
Aug  2 20:10:00 dhcp-209-54-72-117 last message repeated 8 times

I checked all my mac addreses .. IT'S NOT ON MY NETWORK!
Unfortunately I was using 192.168.1.1  I changed the network addresses
and so far it's quiet. That da** cable modem must be letting other users
in from my node.??

I had this on one of my machines an attack??

Aug  2 10:03:08 dhcp-209-54-72-114 ftpd[424]: refused PORT
9.100.139.211,1195 from sungold10.fr.ibm.com [194.196.100.115]
Aug  2 10:25:20 dhcp-209-54-72-114 ftpd[466]: refused PORT
9.100.139.211,1213 from sungold10.fr.ibm.com [194.196.100.115]
Aug  2 10:45:15 dhcp-209-54-72-114 ftpd[479]: francess@fr.ibm.com of
sungold4.fr.ibm.com [194.196.100.100]: data connect from 194.196.100.101
for /bin/ls
Aug  2 10:45:22 dhcp-209-54-72-114 ftpd[479]: francess@fr.ibm.com of
sungold4.fr.ibm.com [194.196.100.100]: data connect from 194.196.100.101
for /bin/ls
Aug  2 10:46:12 dhcp-209-54-72-114 ftpd[485]: francess@fr.ibm.com of
sungold5.fr.ibm.com [194.196.100.101]: data connect from 194.196.100.114
for /bin/ls
Aug  2 10:47:01 dhcp-209-54-72-114 ftpd[487]: francess@fr.ibm.com of
sungold9.fr.ibm.com [194.196.100.114]: data connect from 194.196.100.113
for /bin/ls
Aug  2 10:47:58 dhcp-209-54-72-114 ftpd[489]: francess@fr.ibm.com of
sungold10.fr.ibm.com [194.196.100.115]: data connect from 194.196.100.99
for /bin/ls
Aug  2 10:48:04 dhcp-209-54-72-114 ftpd[489]: francess@fr.ibm.com of
sungold10.fr.ibm.com [194.196.100.115]: data connect from
194.196.100.101 for /bin/ls

and it goes on..............
--
Ted Sikora
tsikora@ntplx.net

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-stable" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3B6A7025.A5F8643F>